Analysis

  • max time kernel
    111s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2024, 14:28

General

  • Target

    90e245ba018674f5961d7db018bcba816c8c1265807f0a33fb3bb9ebf659fb49N.exe

  • Size

    3.2MB

  • MD5

    2d46e6c636d5c2c669d199ed95829650

  • SHA1

    4d07e952a0bdbbf4952d51bee4056b377e09bb86

  • SHA256

    90e245ba018674f5961d7db018bcba816c8c1265807f0a33fb3bb9ebf659fb49

  • SHA512

    3d909719bcf7e3ce65298e84aa7ae67807b437416b7d3ec6556d3ea2f1accc345fc37d980423940cf3da853c17baab434d517529065837696b554142d7d99021

  • SSDEEP

    98304:Cyo81kOupBAA7e5XSoR6xiflSfSY17DfABPz:CVygAB5D6xw2lfAtz

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90e245ba018674f5961d7db018bcba816c8c1265807f0a33fb3bb9ebf659fb49N.exe
    "C:\Users\Admin\AppData\Local\Temp\90e245ba018674f5961d7db018bcba816c8c1265807f0a33fb3bb9ebf659fb49N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:2684

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1968-0-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB

          • memory/1968-1-0x0000000077B50000-0x0000000077B52000-memory.dmp

            Filesize

            8KB

          • memory/1968-2-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB

          • memory/1968-3-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB

          • memory/1968-4-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB

          • memory/1968-5-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB

          • memory/1968-6-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB

          • memory/1968-11-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB

          • memory/1968-12-0x000000013F7F0000-0x00000001400A9000-memory.dmp

            Filesize

            8.7MB